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ABSTRACT 

NASA is working to develop a new lunar lander to support lunar exploration. The development 
process that the Altair project is using for this vehicle is unlike most others. In “Lander Design 
Analysis Cycle 1” (LDAC-1), a single-string, minimum functionality design concept was 
developed, including life support systems for different vehicle configuration concepts, first for a 
combination of an ascent vehicle and a habitat with integral airlocks, and then for a combined 
ascent vehicle-habitat with a detachable airlock. In LDAC-2, the Altair team took the ascent 
vehicle-habitat with detachable airlock and analyzed the design for the components that were the 
largest contributors to the risk of loss of crew (LOC). For life support, the largest drivers were 
related to oxygen supply and carbon dioxide control. Integrated abort options were developed at 
the vehicle level. Many life support failures were not considered to result in LOC because they 
had a long enough time to effect that abort was considered a feasible option to safely end the 
mission before the situation became life threatening. These failures were then classified as loss 
of mission (LOM) failures. Many options to reduce LOC risk were considered, and mass 
efficient solutions to the LOC problems were added to the vehicle design at the end of LDAC-2. 
In LD AC-3, the new design was analyzed for large contributors to the risk of LOM. To avoid 
ending the mission early or being unable to accomplish goals like performing all planned 
extravehicular activities (EVAs), various options were assessed for their combination of risk 
reduction and mass cost. This paper outlines the major assumptions, design features, and 
decisions related to the development of the life support system for the Altair project through 
LDAC-3. 

Introduction: The Altair Project 

The Constellation Program is an ambitious effort that has been said by some to include 
the efforts of Apollo with the Orion Crew Exploration Vehicle (CEV) and Altair Lander Lunar 
missions, the Space Shuttle with Orion CEV missions to the International Space Station (ISS), 
and the ISS with the establishment of continuous human presence on the moon. Whether one 
agrees with that statement or not, there is no doubt that it is a significant effort with significant 
funding challenges in NASA’s current environment. 

In 2006, a study was conducted by a NASA internal team from multiple centers to 
identify the costs of a Lunar Lander development effort based on traditional standards for agency 
large scale projects. Funding for an effort that large would not have fit into the agency’s budget 
until 2011 or 2012, leaving very little time before the intended human return to the moon in 
2020. 

Instead of waiting, a small NASA internal team was formed in 2007 to begin exploring 
design and requirements issues for the Lunar Lander. The initial team included approximately 



50 people focusing on a basic design concept to establish feasibility for a Lander concept. This 
design was the “Minimum Functionality” Lander. 

Eventually, this team officially became NASA’s Altair Project within the Constellation 
Program. The team has grown in size as the design has grown more robust, more complex, and 
more detailed. Overtime NASA’s interaction with the contractor community on Altair has 
grown as well. 

Altair Life Support System Functions 

It is important to define what functions are included in the life support system. 
Previous vehicles have had a range of functions included as part of life support. Sometimes 
thermal control and life support are grouped together as “Environmental Control and Life 
Support System” (ECLSS). The interface line between life support and EVA systems can very 
as well. Airlock components, consumable conditioning, and other functions might be included in 
either system . Sometimes crew accommodations life food, clothing, hygiene facilities, and 
medical equipment and sensors are included in life support, and sometimes as a separate system. 

For Altair, the Life Support system controls the environment of the crewmembers within 
certain standards to protect their health. Controlling the environment includes the temperature, 
total pressure, oxygen, nitrogen, humidity, carbon dioxide, trace gas levels and odors, and 
particulates in the air or breathing gas of the habitable volumes such as the cabin and airlock. 

The Altair project started with a very small team, so many functions that historically are 
separated into unique subsystems were grouped together initially. Also dividing lines were 
drawn to split functions that might have been together in other vehicles. 

The life support system also provides gas and liquid consumables (air and water, but not 
food) for the crewmembers. For now, the life support system is responsible for conditioning 
those supplies, such as heating or cooling water, or maintaining the water within required quality 
standards. In the future a separate crew equipment group or subsystem may be created to best 
integrate with the hygiene, housekeeping, or other systems that need the resource. The life 
support system is also responsible for providing the consumables and working fluids to space 
suits, such as breathable gas or cooling fluid for support via umbilicals while in or near the 
vehicle, or providing water and oxygen for use in the suits and their portable life support systems 
(PLSSs) for activities away from the vehicle. The life support also provides consumables such 
as oxygen or water to medical equipment or systems, but not the treatment devices themselves. 

The life support system also manages metabolic wastes from the crewmembers (carbon 
dioxide, respiration and perspiration, urine and feces) to contain and control (including odor 
control), or dispose of them in a safe manner. It collects thennal loads from the cabin air, or 
other breathing gas heat exchangers, and transfers that heat to the thermal system, but the 
thermal system is ultimately responsible for rejection of that heat from the vehicle. The life 
support system also monitors the environment for off-nominal conditions such as smoke and fire 
detection and other trace gas or particulate release or accumulation events. Also included in life 
support are the systems that provide a survivable environment for the crew in these emergency 
situations, including fire suppression and emergency breathing gases or masks for the duration of 
the event. 

Some of these functions (such as emergency systems) are not a part of a minimum 
functionality vehicle, and are not included in early versions of the design. As perfonnance 
enhancements and additional functions are evaluated, more of these functions, and more 
elaborate versions of these functions, may be included. 



LDAC-1 Overview 

The requirements for the design of the minimum functionality vehicle were reduced to 
only what would be required to perfonn a basic mission. The basic mission for the lunar lander 
can be roughly defined as transporting 4 crewmembers to the south pole of the moon, enabling 
them to survive for 7 days, and allowing them to perfonn EVA activities to explore the surface 
of the moon while they are there. The design does not take into account contingencies or off- 
nominal situations. It does not include redundancy for system failures. It also neglects many 
requirements that are not critical to completion of the basic mission, but might be considered to 
enhance performance. For example, some level of communication is required to successfully 
navigate to the moon and dock with the Orion CEV. But high definition television feed, while 
highly desirable for many reasons, is not required to get to the moon. Providing sustenance for 
the crew is required to enable them to perfonn EVAs, but providing a pleasant (or even more 
than minimally tolerable) diet is not. It is important to note that no one in NASA, especially on 
the Altair team, ever intends for the minimum functionality design vehicle to be manufactured 
and flown. It is a design experiment that establishes a reasonable minimum mass to see if the 
project can be considered feasible from a mass perspective. Going through this process is also 
intended to make the members of the Altair team “Smart Buyers”, who will understand the 
reason that each requirement and resulting system is in place. From the minimum functionality 
vehicle, the design can be built by considering each safety and performance enhancing 
improvement piece by piece. 

LDAC-1 Overall Lander Concept 

The initial lander concept in LDAC-1 included a descent module, an ascent module, and 
a habitation module, as shown in Figure 1. The descent module was the location of the descent 
stage engines that provided propulsion to perform the Lunar Orbit Insertion (LOI) maneuver and 
land safely on the surface of the moon. The habitat, or habitation module, was included to 
support the crew during their 7-day sortie missions with suitlocks on either end to perform 
EVAs. The habitat was carried by the descent module. It was considered a separate module 
because it would not be included in unmanned cargo missions. The lander also included an 
ascent stage, with a pressurized cabin just big enough for four suited crewmembers. The 
crewmembers would also be in this vessel during descent to the lunar surface in case of descent 
aborts, and then perform an EVA to move into the habitat for the duration of the surface mission. 
At the end of the mission, the ascent vehicle and its engines would lift the crew back to lunar 
orbit to rendezvous with the Orion Crew Exploration Vehicle (CEV). 

The two pressure vessels in this concept had distinctly different duration and functional 
requirements. The ascent vehicle was only used to support the crew for a matter of hours, and 
they would wear spacesuits nearly all of that time. The habitat was needed to support shirtsleeve 
habitation for seven days, support EVAs, and provide food, hygiene, and waste facilities. 




Figure 1: Major Modules of the LDAC-1 Lander 


Life Support for the LDAC-1 Ascent Stage 

The mission duration and suited crewmember operations concept were the primary 
drivers of the life support system design. For duration, it was only required to provide life 
support for the crew for 12 hours. This meant that it could rely on consumable technologies 
without the mass growing too large. For the operations concept, it was assumed that the Orion 
CEV would provide life support to the crew working in the ascent stage when the two vehicles 
were docked. The ascent stage had no airlock, so depressurized operations were required, and it 
supported crewmembers wearing space suits. This meant that a suit loop architecture (where the 
vehicle provides life support to suited crewmembers via umbilicals) was appropriate. It was 
noted that spacesuits have a similar requirement set since they support crewmembers for short 
durations (8-hour EVAs). Using the Portable Life Support Systems (PLSSs) that the 
crewmembers would have used during lunar surface exploration was considered as an option. 
But the PLSSs don’t provide all required functions (such as cabin pressurization and ventilation 
to dock to Orion). They also provide functions that are not useful in a powered, pressurized 
spacecraft, such as communication systems, power storage in batteries, and heat rejection by 
water evaporation. Bringing PLSSs rather than using a vehicle life support system was rejected 
because it was a more massive solution. 

The ascent stage life support was very simple with only pressure control, air 
revitalization, and a small water subsystem. 

The ascent stage only carried oxygen as stored gas. Repressurization of the mixed-gas 
cabin before launch from the lunar surface would be provided by nitrogen tanks stored on the 
descent stage. The oxygen tank was also used to provide pressure on the gas side of the bellows 
on the water storage tank shared between life support and thermal. The ascent stage was 
assumed to operate at 70 kPa (10.2 psia) because it had to dock with the Orion CEV at that 
pressure. A positive pressure relief valve would vent gas during the ascent from the Earth’s 
surface so that the structure did not have to maintain a 101 kPa (14.7 psi) differential pressure. 
Valves on the hatches to equalize with the CEV or vent to the lunar environment were also 
included. 

The air revitalization system, referred to as the “suit loop”, maintained the air quality 
either of open cabin air or of gas flowing to suited crewmembers. The cabin air could be 
conditioned during the periods before the crew fully donned and leak checked their EVA suits 
for descent and when they opened their helmets after ascent when docked to CEV. In suited 
mode, the air revitalization system treated the oxygen flowing to and from the fully suited 
crewmembers via umbilicals. These umbilicals would also be used on the Orion CEV, so they 
were removable. The suit loop included a HEPA filter, Lithium Hydroxide (LiOH) canisters 
with a small amount of charcoal sorbents, and a condensing heat exchanger. 


A water loop with a filter, gas liquid separator, pump, and heat exchanger provided 
cooling to suited crewmembers via their liquid cooling gannent (LCG). Water stored for use in 
the vehicle’s sublimator during ascent was also used as the accumulator and to provide 
pressurization to the water loop. Drinking water and waste facilities were not included because 
the crewmembers were assumed to be wearing spacesuits during the few hours in which the 
ascent vehicle was used. 

Life Support for the LDAC-1 Habitat 

The LDAC-1 lander habitat provided many more functions than the ascent stage, and had 
a more complex life support system. 

The habitat was required to provide split-operations, meaning that some (normally two) 
crewmembers could be out performing surface exploration activities, while the remaining 
crewmembers were inside the habitat in a shirt sleeve environment. The habitat featured two- 
person suitlocks on either side of the habitat’s horizontal cylinder shape. The crewmembers who 
were preparing for EVA needed to breathe pure oxygen, while the others continued to breathe an 
oxygen-nitrogen mixture. One air revitalization system cannot simultaneously condition pure 
oxygen and a mixed gas atmosphere. 

Rather than create two air revitalization systems, the airlocks were to be equipped with 
vacuum ports that would enable the Portable Life Support Systems (PLSSs) on the spacesuits to 
begin to operate before the airlocks had been depressurized. The PLSS oxygen tanks needed to 
be refilled before each EVA. LDAC-1, oxygen for the habitation module was stored in a high 
pressure tank. But since the pressure in this tank would decrease over the 7-day mission, 02 was 
taken from the primary storage ta nk and slowly pressurized to 25000 kPa (3600 psi), so that it 
could be used to refill PLSS tanks to 21000 kPa (3000 psi). The compression system was 
assumed to be a multi-stage system with both mechanical and sorption (solid-state) compressors. 
Since it was a multi-stage system, the early stages could be bypassed when the pressure in the 
source ta nk was still high. Water from a storage tank was circulated through a cooling system 
(much like in the ascent stage) and fed to the airlock. The PLSSs would accept this water to 
refill tanks and to recirculate it through the LCGs of crewmembers preparing for EVA. 

Inside the habitat, the design included an oxygen-nitrogen mixture at 57 kPa (8.3 psia) 
controlled to just under 34% CL. Oxygen and nitrogen were stored in high pressure tanks. The 
nitrogen feed was also available as fire suppression by routing the flow to areas with large 
collections of electronics. The cabin air was drawn from vents throughout the volume and the 
waste and hygiene area. The air was filtered, and then slip streams were passed through trace 
contaminant control and COo and H 2 O removal systems. Trace contaminant control was 
primarily assumed to be carbon sorbents, with some ambient temperature oxidation catalysis, and 
sorbents treated for ammonia removal. Control of carbon dioxide and humidity removal was 
performed with two amine swing beds common to the Orion CEV design. The dried air was 
drawn through the cabin fan. Finally, the air flowed through a non-condensing heat exchanger 
with a bypass for temperature control. 

Food preparation, hygiene, and waste collection were also provided in the habitat 
module. The power system designed for DAC-1 featured fuel cells that produced water as a 
byproduct of reacting O 2 and H 2 to generate electrical power. The water produced by these fuel 
cells was stored by the life support system. A small ta nk of concentrated silver ion solution was 
included to be added as a residual biocide. This treated water would have been provided to the 
EVA suits and PLSSs. The water provided to the ascent stage sublimator was not treated with 



the biocide because of concerns that it would be sensitive to accumulation of silver in the porous 
metal foam. It was provided to the crew via lines and manual valves at a galley station, and in 
the waste and hygiene area. In the waste area, urine would be vented directly overboard with a 
small amount of cabin air. Solid waste would be collected in a canister. For relatively little 
mass, a single-use bag based on the Shuttle Extended Duration Orbiter (EDO) Waste Collection 
System (WCS) and an odor-removing lid for the canister between uses was included. Since 
gravity is available on the lunar surface, including a fan in the waste collection system is not 
required to draw urine or fecal waste away from the human body, and, therefore, was not 
included. 

Life Support for the LDAC-1 Descent Stage 

The source and location of life support consumables did impact the descent stage of the 
LDAC-1D descent stage. In LDAC-1, it made sense to locate consumables for the surface stay 
with the habitat module. Since the habitable volume in LDAC-1D was the ascent module, 
keeping the consumables and tanks required for the mission on that module was not desirable. 
Mass on the ascent stage has the highest “gear ratio” of propulsion mass required of any location 
on the lander. Also during LDAC-1D, the quality of oxygen required for propulsion, fuel cells, 
and life support was compared. The standards for the three purposes are definitely different, but 
did not appear to be so different that a common definition could not be created that met all 
requirements. At the end of LDAC-1 D, the life support system maintained a nitrogen ta nk on the 
ascent stage, assuming that it would eventually be needed for contingency repressurization after 
ascent. Oxygen tanks on the ascent stage were only designed for the same minimal duration of 
the LDAC-1 minimum ascent stage. During the surface operations for a Sortie mission, life 
support would utilize boiloff from the descent stage’s cryogenic oxygen tanks to provide for 
metabolic oxygen, airlock repressurization, and EVA needs. 

Life Support on the LDAC-1 Descent Stage 

In LDAC-1, the life support design did not include any mass as part of the descent 
module. Mass that did not have to return with the ascent stage was all labeled as part of the 
habitation module so that it could easily be removed for cargo mission mass estimates. 

LDAC-1 Conclusion 

Overall, the separation of functions between a habitat module and ascent module was 
efficient for the design of the life support system. The subsystem in LDAC-1 was estimated to 
have a mass of only 58 kgs in the ascent module and 240 kgs for the habitat module. However, 
the overall design was not as optimal for other vehicle systems. The lander was constrained to a 
diameter to fit inside shroud of the Ares-V rocket that would launch it from Earth. The habitat 
module needed to be placed on the center line of the vehicle to maximize their length, and 
potentially enable them to be used on the lunar surface as part of a permanent Outpost. To be 
useful, the habitat also needed to be close to the surface. Providing a structure that can survive 
the loads induced by the lander’s powerful descent stage engines and the Earth Departure Stage 
(EDS) while holding an open space in the center for the habitat ultimately was not an efficient 
structural solution and the overall lander mass was too high. Before the end of the analysis 
cycle, a “delta” design was developed. The biggest changes were in the structural system, but 
the other systems had to respond to the reconfiguration as well. This redesign period was called 
“Lander Design Analysis Cycle 1 - Delta” (LDAC-1D). 




Figure 2: Altair LDAC-1 Life Support for the Minimum Ascent Stage 



LDAC-1D Overview 

In the beginning of the LDAC-1D process, the team broke the pressurized volumes of the 
lander into three functions: an ascent vehicle, a 7-day habitat, and an airlock. Many 
configurations were considered grouping these into 1 to 3 volumes. For completeness, all were 
considered at least briefly. Some of these did not make much sense for the life support system. 
For example, one of the pennutations that was projected to save mass had an ascent vehicle with 
air revitalization equipped to support the non-EVA crewmembers, but any habitation functions 
that were not required for ascent would be moved to a detachable airlock. But this would have 
left waste collection and drinking water unavailable to the non-EVA crewmembers while the 
others were away, so that the airlock could be available for quick return. Even though this 
combination saved mass, it was not very effective at performing the required functions for 
habitation. Ultimately the configuration selected was an ascent-stage/habitat, with a detachable 
airlock that could be left on the lunar surface, as show in Figure 2. This two-volume 
configuration has continued to be the basis of design work since then. 
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Figure 4: Major Modules of the LDAC-1D Lander 
LDAC-1D Life Support 

With the new allocation of functions to volumes, most of the life support functionality 
was contained in the ascent stage. The air revitalization system was split into two separate flow 
paths: the suit loop system, and the cabin fan system. With the longer duration, the regenerable 
amine swing beds used in the habitat in LDAC-1 were used for C02 and H20 control in the 
ascent stage now. Only the amount of air required for C02 and H20 control would flow through 
the suit loop air revitalization system. The connectors for the umbilicals that to connect the life 
support system to the crew in the suits add pressure drop, and therefore power cost, even when 
the life support system is conditioning the cabin directly. More flow is required to control air 
temperatures in the cabin. A separate cabin fan and heat exchanger was used to remove any 
remaining heat not controlled by the suit loop air revitalization so that this larger flowrate went 
through a lower total pressure drop system. Pressure control in the ascent stage became a multi- 
setpoint system to enable surface operations and docked operations with the Orion CEV, but the 
other aspects of the design remained the same. Waste systems and potable water systems were 
moved to the ascent module but were largely unchanged from DAC-1. EVA water systems 
provided the liquid cooling garment support to suited crewmembers in the ascent stage, and 
included a path to deliver water to the PLSSs where it could be recirculated for cooling or used 
to fill tanks for use during the EVA. The oxygen compression system was included with the 
detachable airlock, which still had vacuum vents to enable the PLSS to function while the airlock 
is pressurized. The total life support system mass was estimated at 2 1 1kg. This is a net 
reduction in life support system mass, since only one air revitalization system is included. But 
much more life support mass is placed on the ascent module, so it bears a higher penalty for 
propulsion to land it safely on the surface and return it to lunar orbit with the crew. 

Life Support on the LDAC-1D Descent Stage 

The source and location of life support consumables did impact the descent stage of the 
LDAC-1D descent stage. In LDAC-1, it made sense to locate consumables for the surface stay 


with the habitat module. Since the habitable volume in LDAC-1D was the ascent module, 
keeping the consumables and tanks required for the mission on that module was not desirable. 
Mass on the ascent stage has the highest “gear ratio” of propulsion mass required of any location 
on the lander. Also during LDAC-1D, the quality of oxygen required for propulsion, fuel cells, 
and life support was compared. The standards for the three purposes are definitely different, but 
did not appear to be so different that a common definition could not be created that met all 
requirements. At the end of LDAC-1D, the life support system maintained a nitrogen ta nk on the 
ascent stage, assuming that it would eventually be needed for contingency repressurization after 
ascent. Oxygen tanks on the ascent stage were only designed for the same minimal duration of 
the LDAC-1 minimum ascent stage. During the surface operations for a Sortie mission, life 
support would utilize boiloff from the descent stage’s cryogenic oxygen tanks to provide for 
metabolic oxygen, airlock repressurization, and EVA needs. 

LDAC-1D Conclusion 

The final LDAC-1D Lander concept, while not without errors, was considered a 
sufficiently “closed” concept for a minimally functional (not flyable) vehicle for a minimal mass 
solution. The mass of the vehicle was beneath the target established for Altair by the lift or 
Delta-V capability requirements of the Ares V launch vehicle and Earth Departure Stage. 
Parametric studies at the vehicle level were conducted to estimate the mass of a flyable vehicle 
so that the team could move forward with sufficient confidence that a flyable design within 
limits could be achieved. 

The LDAC-1D lander was also used as the starting point for an Altair project “Broad 
Area Announcement” contract announced in December of 2007. In the first part of this contract, 
companies were asked to identify any improvements in a minimal-mass minimum functionality 
design. Those results were compared to the LDAC-1D design to see where there were areas for 
improvement. The life support design results were largely supported by the contractor efforts. 

In the second part of the contract, the contractor teams used their own analysis methods and 
techniques to independently detennine what changes should be made to reduce the “Loss of 
Crew” risks in the LDAC-1D vehicle design. Those results were then compared with the NASA 
LDAC-2 designs. The contract also asked for industry input on effective teaming between 
government and industry during the development phase as the Altair design matures. 




LDAC-2 overview 

The Altair team began LDAC-2 with the goal of finding mass efficient solutions to 
reduce the LOC risk of the design. The vehicle configuration for LDAC-2 that drove life support 
design were very similar to LDAC-1D, though the vehicle had expanded it’s width to a 10-m 
maximum diameter in the Ares V launch shroud. 

The LDAC-2 work began by identifying life threatening hazards and the single point 
failures that could cause them. The vehicle hazards included “Failure to Ascend or Rendezvous 
with CEV”, “Impact or Crash”, “Explosion”, “Fire”, Loss of Control”, “Radiation”, and “Loss of 
Breathable Atmopshere”. Several different types of options were to be considered for those 
failures. One path was to determine whether dissimilar redundancy was present by using other 
vehicle capabilities, or if a dissimilar system solution was available to be implemented. A 
second option was to see if there was a more reliable single string solution available, or if testing 
or other development could make the system more reliable. For some systems (such as the 
structural pressure vessels, or engines) testing and development work to increase confidence in 
the single-string solution may be the most appropriate solution. Finally, adding a redundant 
string (or distributing the function into redundant strings each with reduced capability). Aborting 
the mission was not supposed to be considered by the subsystem teams as a valid solution for 
dealing with their failures. However, mission aborts were considered in DAC-2 at the vehicle 
level. The lander team also used DAC-2 to evaluate capabilities required for mission aborts. 
Subsystems were asked to examine a “lifeboat” mode for surviving extended durations, or with 
reduced power, for some of these cases. 



LDAC-2 life support system 

Defining LOC failures in the life support system for LDAC-2 required a little bit of 
negotiation. Almost by definition, anything appearing in a minimum functionality and single 
string life support system is required to keep the crew alive! Even failed waste collection 
systems could eventually become life threatening if infectious microbial growth spread, or 
offgassed chemicals overwhelmed the design size of the trace contaminant control system 
allowing ammonia or other hazardous gases to exceed their Spacecraft Maximum Allowable 
Concentration (SMAC) limits. But it was unreasonable to imagine that a crew would stay on the 
surface until they became very ill, when ending the mission and returning to the CEV would 
quickly bring them to a fully functional life support system. However, calling this early return to 
the CEV an abort implied an increased risk because actions were not taken per the nominal plan. 
Eventually it was determined that the life support system would consider LOC failures that 
would prove life threatening within a few hours. Failures that became life threatening after days 
would allow enough time to have an early mission end that included the nominal ascent 
procedure. All of the single point life support failures that fit into this category reduced to the 
“Loss of Breathable Atmosphere” hazard. 

Loss of Atmosphere Failures 

The first set of failures that were examined under “Loss of Breathable Atmopshere” were 
those that resulted in the complete loss of atmosphere. Many of the cabin penetrations that could 
leak to vent the atmosphere were assumed to be small enough that they could be sustained by the 
cabin pressure system until they could be capped. If the leak could not be identified, the crew 
could don their space suits and use the suit loop life support to return safely to the CEV. 
Examples of these leaks were the urine and wastewater vent line, a leaky hatch seal, or a leaky 
pressure equalization valve. Three possible leak paths were identified that did not have those 
solutions, and are discussed below. 

The first potentially serious leak was the positive pressure relief valve (PPRV). Detailed 
orifice sizing had not yet been performed on this valve. But the design had established that it 
would be mechanical to automatically relieve pressure, and large enough to vent cabin pressure 
from Earth atmosphere to something slightly above the 70 kPa (10.2 psia ) atmosphere the 
Lander would use when docked with CEV. Since ascent on an Ares V is expected to be fast, the 
valve was expected to have a relatively large orifice. If it accidentally opened while the crew 
was sleeping, they might not have time to reach it and attempt to manually close it before 
pressure in the cabin dropped significantly. An electronic valve was added to the PPRV 
assembly that would be closed automatically by vehicle control if cabin pressure dropped 
rapidly. The valve would be “normally open” to reduce the risk of it accidentally failing closed 
and preventing the PPRV from perfonning the relief function during ascent from Earth. 

The second leak path identified was the suit loop purge line. When the purge valve on 
this line was open, gas would be vented from the suit loop to space. The suit loop, umbilicals, 
and space suit free volume all need to be flushed with oxygen so that nitrogen from the cabin air 
is removed before low pressure suited operations. In a small volume, this could add oxygen to 
the cabin quickly and exceed the 34% CL concentration limit, so the purge gas was dumped 
overboard in the minimum functionality design. Even though this purge is a small flow rate, it 
does not fit into the first category of leaks that can be “fed” because neither the cabin nor the suit 
loop can be sustained as a pressurized environment with a reasonable quantity of consumables 



long enough to survive ascent. As a solution, the line was routed to dump the oxygen to the 
cabin. This may require use of extra nitrogen to maintain Ot concentrations, and possibly 
venting of cabin gas. That cost was considered acceptable compared to the potential loss of life 
from losing pressure in the suit loop. 

The third leak path considered critical was in the amine swing bed units used to control 
carbon dioxide and humidity. Each unit is constructed like a heat exchanger with alternating 
layers of sorbent beds. The technology uses a pressure swing adsorption process. In each unit, 
one “bed” is exposed to cabin air, while the other “bed” is exposed to vacuum. If a leak path was 
present in the valve that controls air flow or in the heat exchanger style assembly itself, it could 
create a path from the suit loop to vacuum. This is unacceptable for the same type of reasons 
that it was in the suit loop purge valve case. The amine swing bed does require vacuum to 
operate, so it cannot simply be routed to the cabin. As a solution, the two amine swing bed units 
were given separate overboard vent lines, and a normally open valve was placed on the line to 
isolate a leaky amine swing bed unit from vacuum. These amine swing beds are still considered 
a technology development project for NASA’s Exploration vehicles. The Altair team recognizes 
that highly reliable construction and performance on the Orion CEV, redundant sealing surfaces 
in the valve, or valve designs that cannot physically create such a leak path may remove the need 
for these isolation valves. 

Loss of Oxygen Control Failures 

The second category of failures considered that could cause “Loss of Breathable 
Atmosphere” were those that resulted in a loss of oxygen control. Lack of oxygen due to tank 
failures, control systems that added too little oxygen, or control systems that added to much 
oxygen creating a fire hazard were all examined. 

The loss of oxygen stores were assumed to be related to the small oxygen tanks on the 
ascent module. If the supply of oxygen scavenged from the descent stage was interrupted, the 
ascent stage oxygen tanks could be used to supply breathable atmosphere to the crew, though the 
duration would likely increase. Failure of an oxygen storage tank, or the valve isolating the ta nk 
during the surface stay, was a critical failure. If the valve stayed open, the oxygen in the tank 
would be consumed during the surface stay and not be available for ascent. If the valve failed to 
open during ascent, the crew metabolism would reduce the oxygen in the suit loop and cabin 
atmosphere to unacceptable levels. The oxygen tanks also became an important part of the abort 
studies examined at the vehicle level. Several of the abort cases required extended loiter 
durations in lunar orbit before the Altair lander could rendezvous with the Orion CEV. As a 
solution, a second ascent stage oxygen ta nk and isolation valve was added to the vehicle. Each 
ta nk was sized to survive a nominal mission alone. The two tanks together could survive an 
extended duration abort. 

Failure of the control system that would introduce oxygen was also a critical failure. A 
multi-component sensor measured the oxygen levels in the vehicle to control gas addition. It is 
referred to as the “Major Constituent Analyzer”, but not assumed to be identical to ISS hardware 
of the same name. If the sensor failed completely, the crew could don their suits and breathe 
pure oxygen in the suit loop where no composition control is required. Analysis or ground tests 
could determine the amount of time required to purge the loop even if the sensor was not 
operating to verify the purge was complete. But if the sensor was reading incorrectly, the crew 
could asphyxiate or be working in a highly flammable environment without notification. This is 
especially important if the failure occurred while the crew was sleeping and unable to notice 



their own symptoms. Two additional oxygen sensors were added to the design to check the 
measurements of the MCA. The total of three 02 measurements allowed voting logic so that if 
the sensors started to disagree, the one with the disagreeing reading would be assumed to 
incorrect. Even if two sensors were wrong, and one was right, the disagreement would cause the 
crew and ground support to begin a diagnosis and troubleshooting process to find the issue. 

Failure of the nitrogen system was not considered a LOC failure. Since nitrogen is not 
metabolically consumed, the levels in the cabin should remain relatively constant for awhile after 
the supply fails. The nitrogen control valve that detennines whether 02 or N2 was added was 
assumed to be in the cabin volume where the crew could try to manually close it if it failed open. 
This would provide the crew with enough time to don their space suits and use the suit loop as 
the controlled, pressurized volume for a safe ascent. 

Accumulation of COo 

The only gas phase contaminant expected to accumulate to serious levels before the crew 
could return to the Orion CEV was carbon dioxide. CO 2 could accumulate if the amine swing 
beds failed to operate. It would also accumulate if the suit loop compressor or controller failed 
to operate and didn’t force the C02 through the swing beds. 

The LDAC-1D vehicle already included two swing bed units. One unit would be 
sufficient to provide CO 2 control for the vehicle, but two units were expected to be required for 
humidity control during high metabolic load periods. This sizing was based on commonality 
with the units developed for Orion, and not for deliberate redundancy. But it was the need to 
maintain this redundancy that drove the need for separate vent lines and isolation valves when 
solving the amine swing bed leak risk. 

The suit loop compressor and the amine swing bed controller were considered potential 
critical failures. In LDAC-1D, the life support design included a suit loop compressor that 
would provide low flow through high pressure drop to suited crewmembers, or higher flowrates 
through a reduced pressure drop to the open cabin. The Altair team considered trying to break 
the compressor into more smaller compressors, similar to the strategy that works for the amine 
swing bed. But losses due to flow mixing mean that two compressors manifolded together may 
not necessarily produce double the flow of the original compressor. Multiple distributed 
compressors that could sustain performance after one failure were estimated to be more massive 
than simply two redundant compressors. A redundant controller was added to the system as 
well. The complexity of the controllers was increased so that it could direct the remaining 
compressors and amine swing beds to adapt to a failed state by increasing flow or changing cycle 
time. 

The suit loop compressors were also considered important for the lifeboat cases examined 
at the vehicle level. The compressors are the largest power draw in the life support system, and 
would be a significant load if the vehicle was trying to survive on a trickle of power. Several 
chemical methods of C02 were considered as a low power backup. Many of the highly 
exothermic systems were rejected because the Altair lander is such a small vehicle. LiOH 
systems were selected as the most reasonable choice. A LiOH canister still requires a fan to 
draw cabin air through it. Instead, a LiOH mask was selected. The mask would be designed to 
allow the crewmembers to breathe cabin air, but exhale through a LiOH cartridge. With this 
design, C02 levels would not rise in the cabin like they would if the mask filtered LiOH as the 
crewmember inhaled, and the environment would be safe when the Lander docked with the 
CEV. 



Humidity was considered as a potential LOC failure. While humidity should not be life 
threatening to the crew, condensation could potentially disrupt avionics systems. The Altair 
team assumed that all avionics and electrical wiring in the design that are inside the pressurized 
ascent module would be coated to protect them from humidity. 

LDAC-2 Conclusion 

Changes to the life support system provided effective ways to reduce risk of loss of 
function in the most critical systems. In many cases, since an efficient single string design had 
been selected in the first place, adding a redundant component of the same design was still the 
most mass-effective choice. Life support systems were mostly added as “cold spares”, or 
components that only actuated after a failure. As a result, they created relatively little impact on 
the power and heat rejection capability for the vehicle. Each of the critical functions examined 
in LDAC-2 remained important in LDAC-3. Loss of one of the components performing these 
functions would leave the vehicle one failure away from LOC, and possibly require an early end 
to the mission. Functions that were not included 



LDAC-3 Overview 



The Altair team’s efforts in LDAC-3 were organized around reducing the risk of Loss of 
Mission. The first challenge was for the technical management of the Altair team to define what 
would count as losing the mission. Several of the criteria for loss of mission were not usually 
relevant to life support: 

1) Lander fails to reach the desired lunar landing area, 

2) All cargo is not transferred to the surface, 

3) Vehicle data and communication is maintained for health monitoring of critical 
systems and uplink of critical data, and 

4) Crew and cargo returns to Orion through the Low Impact Docking System (LIDS) 
hatch. 

The other 5 criteria selected were relevant to life support system failures. These criteria 

were: 

1) The entire crew is not able to exit the lander, access the lunar surface, and perfonn 
two-person per day EVAs, 

2) The lander does not maintain an acceptable environment for the EVA crewmember 
outside the lander, 

3) The pressurized ascent module is not maintained with an environment suitable for 
shirtsleeve (unsuited) operations 

4) 7 day stay on the lunar surface is not achieved due to a loss of a function or capability 

5) 7 day stay on the lunar surface is not achieved due to a loss of redundancy in a life 
critical function or capability 

During LDAC-3, some of the lander subsystem teams, including life support, investigated 
what other sensors would be required to detect the failures identified in LDAC-2 and LDAC-3 so 
that contingency action could be taken. 

LDAC-3 Changes in the Pressure Control System 

The pressure control system includes critical, life sustaining functions and functions that 
are not critical for crew survival but enable EVA operations or interfaces with CEV. 

The simplest PCS changes in LDAC-3 were in pressure equalization or venting valves. 
Redundant manual pressure equalization valves with caps were used on all the hatches. This 
gives redundancy to the pressure equalization or airlock depressurization capability so surface 
EVAs can be perfonned, and shirt sleeve transfer to and from the Orion CEV can be performed. 
The caps provide a second method of closing the valves in case they are leaky or stuck. The 
powered vestibule vent valve, which relieves the pressure trapped between the Orion CEV and 
Altair lander before separation or maneuvers, was given a redundant valve in series. The Orion 
CEV already has a vestibule vent valve, so redundancy to perfonn the function was not needed. 
But since the valve is not always accessible to the crew, using a cap is not a feasible method for 
stopping a leaky valve. A redundant positive pressure relief valve (PPRV) assembly with filter 
and isolation valve was also added. A PPRV that fails to open is not life threatening, because no 
crew is present during the launch of the Altair lander from Earth. But failure to open would 
rupture the pressure vessel, ending the mission before the vehicle even leaves Earth orbit and 
begins to travel to the moon. 

The next set of failures addressed was in the cabin pressure control for shirtsleeve 
environments. The nitrogen ta nk itself was considered reliable enough that additional tanks were 



not required. In future DAC cycles, the stored nitrogen may be split into ascent stage and 
descent stage stores to optimize the mass of the ascent stage. This strategy has not yet been 
implemented while there is still an undefined requirement for nitrogen required after ascent for 
vehicle repressurization or O 2 concentration control in contingency scenarios. From the single 
nitrogen tank, dual delivery paths were included with isolation valves for the tank, step-down 
pressure regulators, and nitrogen control valves inside the cabin. Inside the cabin, each delivery 
line leads to one of two redundant electronic cabin pressure regulators. The electronic regulators 
were selected to make the Altair design flexible, since multiple pressure set points are required 
throughout the mission. 

Changes were also made in the oxygen supply systems in LDAC-3. Because ascent 
module oxygen tanks are so critical to the crew during ascent, a third oxygen tank was added. 
The capacity of the new tank will be just enough to perform a nominal ascent or descent abort. 
Each of the three oxygen tanks has an isolation valve, a step-down pressure regulator, and a 
check valve. Also, the interface for the delivery of scavenged oxygen from the propellant tanks 
was more clearly defined. At the separation interface between ascent module and descent 
module, two parallel paths for O 2 delivery are included. Each of these paths has a powered 
isolation valve with a backup a check valve to close the line after separation. 

After oxygen from any of these sources flows to the cabin, there are many routes 
available to deliver it to the crew. Oxygen flowing to the cabin passes through two check valves 
in series so that the higher pressure nitrogen cannot flow back into the O 2 supply lines. A 
selector valve determines which of the two cabin pressure regulators are being supplied. A 
manual oxygen bleed valve was added to the cabin supply to provide metabolic oxygen to the 
crew long enough to don suits or establish workarounds if there are problems with the cabin 
pressure control system. In suited modes, a 3- way valve ( with A, B, and Off positions) 
detennines which of two demand pressure regulators are supplying 02 to the suit loop if that 
mode is being used at the time. Redundant check valves in series were used in the suit loop to 
ensure that oxygen is forced through the purge operations rather than short circuiting to the vent. 
A manual bypass valve around those check valves was added in case a check valve fails closed. 

LDAC-3 Changes in the Air Revitalization System 

Very few significant schematic changes were added to the lander ARS in LDAC-3. 
Design maturation or refinement did change the mass estimates for several components. A more 
detailed sizing estimate was performed on the trace contaminant control system and HEPA 
filtration system to update the mass of those components. Also, Altair agreed to provide forced 
ventilation of filtered air to Orion after a nominal ascent from the moon. This ventilation would 
be provided by the cabin fan by pushing air through the umbilical hose normally used to draw air 
from the airlock when the hatch is open during surface operations. This design decision should 
reduce the amount of lunar regolith or dust that moves from the lander to the CEV after ascent. 

Humidity control was considered as a possible loss of mission threat in LDAC-3. 

Detailed transient analysis of the system was perfonned to investigate whether the size assumed 
for the amine swing beds would provide sufficient humidity control after one failure. The 
analysis showed that one unit was more than sufficient to support nominal metabolic rates. The 
Orion units have to provide humidity control while one crewmember is exercising and three 
others are present. Altair has not yet added all of the Human Systems Integration Requirements 
(HSIR) document content to the vehicle design. For LDAC-3, the team assumed that 
crewmembers would only have to exercise on days when they did not perform EVAs. The 



exercise mode would only be for one crewmember exercising, and one at nominal rates. 

Estimates showed that two crewmembers donning suits and two at nominal rates became the 
most challenging case, and the full Orion capability was not required to support this. A reduced 
mass estimate for the amine swing beds was implemented based on this analysis. After one 
failure, Altair would still be able to support nominal metabolic rates without condensation in the 
vehicle. Cleaning up condensation could be required for a system with one failed amine swing 
bed unit, but vehicle operators could decide whether they wanted to continue the mission with 
that capability, and immediate abort would not be required. It is very important to note that the 
Altair team’s interpretation of the HSIR exercise requirement will almost certainly be challenged 
as part of it’s System Requirements Review, and the units may need to return to their original 
design size. 

The cabin fan and cabin ventilation system was not identified as a critical function in 
LDAC-3. On the lunar surface, natural convection will provide some gas mixing in the cabin. 
Critical systems in the Altair vehicle will already have to be liquid cooled, rather than passively 
cooled, to survive during depressurized cabin contingencies, or portions of the Outpost mission 
when the crew enters or exits the vehicle. 

LDAC-3 Changes in the Water System 

Changes to the water systems in LDAC-3 focused on maintaining water quality during 
the mission, and providing water to the sublimator. Microbial control strategies have to 
acknowledge that no biocidal agent is going to kill all microbial life (or at least no biocidal agent 
that is not life threatening to the crew). Lilters were added to the water design at the hygiene 
valve and the food & drink water supply valve. A pore size of 0.2 micron was selected as a 
reasonable size to block most bacteria. Also, the team addressed microbial control in the LCG 
loop during the long dormant period during Outpost missions. Unlike EMU experience on the 
ISS, the new PLSS proposed for lunar Exploration does not use condensate from human 
respiration and perspiration as a source of water for heat rejection. As a result the LCG loop in 
the lander will be exposed to much less microbial contamination than previous systems. The 
team decided to try to keep the lander at a low temperature (but above freezing) during donnancy 
to slow microbial growth. But no additional measures were added. 

LDAC-3 work also resulted in changes to the sublimator water storage tanks. Incomplete 
work from LDAC-2 had left the thermal system with a single microgravity compatible bellows 
tank. The potable water tank in the life support system was not required to be operable in 
microgravity, and was not a bellows tank. Lailure of the sublimator tank was a LOC failure 
because the vehicle would not survive ascent without cooling. The team selected a design that 
made the potable water ta nk a fixed charge pressurized tank. Several changes in assumptions 
made this possible. The silver biocide in the potable water tank may not be acceptable for 
nominal use in the sublimator. It was assumed the the sublimator could survive at least ascent 
durations while being fed with water containing silver biocide. Also, the sublimator operates at 
very low pressure, and does not need the same level of water pressure required for potable water 
delivery to the cabin. If the pressurization system to the sublimator ta nk failed, water could be 
drawn from a potable water tank with a contained gas charge in microgravity. Loss of drinking 
water would be a LOM failure, but the team determined that a simple tank was reliable enough 
that it did not need to be made redundant. 


LDAC-3 and the Waste System 



During LD AC-3, the technical management team did not accept failure of the waste 
system as a reason for loss of mission. For the minimum functionality vehicle, solid waste 
collection is little more than individual use bags under a minimal seat and a collection canister 
with a lid. Credible failure modes are hard to identify. The urine system vents directly 
overboard. On the moon having a gravity field means that collection of urine does not have the 
same phase separation challenges as in toilets designed for microgravity use. For the minimum 
functionality design the waste canisters, or absorbent material in zip-top bags was proposed as 
backups if the vent system failed. In the final design, using a set of lower powered heaters in 
parallel on the vent line to prevent freezing of fluids could help create a more robust system. 

Fire and Emergency Systems 

The life support system typically has responsibility for fire detection and suppression on 
a NASA spacecraft. While a fire is certainly a failure that could lead to loss of crew, in LDAC-2 
the analysis method did not identify life support functions that would directly lead to a fire. In 
LD AC-3, however, the team acknowledged the need to study fire suppression options as part of 
having a vehicle that was not one failure away from being unable to maintain the environment as 
materials burned. Several factors are important when considering the risk of fire on the Altair 
lander. The nominal vehicle atmosphere could be up to 34% O 2 , which increases flammability 
risk. The lower total pressure of the lander also will increase the flammability of materials in the 
vehicle. NASA is considering, and likely to accept, a change from a 28VDC electrical system to 
a 120VDC electrical system for the Orion CEV and then the Altair lander, which increases the 
risk of electrical discharge as an ignition source. 

NASA would like to find a single fire suppression method that is applicable for all 
Exploration vehicles. Altair has selected a fine water mist fire extinguisher as the preferred 
solution for the lander. Many of the Altair avionics units are installed outside the pressurized 
vessel. Since Altair does not have the localized pressurized avionics bay Orion does, an 
automated diluent gas purge is not an effective solution in Altair. In the small volume of the 
ascent module, a diluent like nitrogen or halon could cause a hazardous environment for the crew 
trying to fight the fire. The diluents systems also had higher mass estimates. Water mist was 
preferable to water foam solutions or water spray solution because it was less damaging to 
equipment, and had a lightweight mass estimate. 

LDAC-3 Conclusion 

The changes made to design LDAC-3 life support system resulted in a design with 
significantly lower LOM risk. Several significant risks still exist, and will be addressed in later 
work. Also, while the LDAC-3 is a safer design than the LDAC-1 minimum functionality 
design, it is not “fully functional”. 




Conclusions 

The Altair life support team, with contributions from many people over the last few 
years, has made significant progress in finding a feasible design to meet a minimal requirements 
set for a lunar lander. The team has learned a great deal about the requirements considered so 
far, and the options and costs required to implement them. But the work is far from complete. 

Several areas of immature requirements, or requirements not yet considered, could have 
major impacts on the life support system design. The Altair lander is expected to primarily 
interface with the Lunar Surface Exploration configuration of the new spacesuit, which is still 
highly undefined. This leaves uncertainty in the interfaces to the EVA suits and PLSSs, but also 
in defining the methods and quantities of lunar regolith or dust that will be brought into the 
Altair environment via EVA. The Altair life support system relies heavily on oxygen scavenged 
from propellant tanks. The time it will take to make that oxygen available to other vehicle 
systems, and the amount of helium initially present are still undetermined. Also, the Altair team 
did not include all of the NASA Constellation level requirements in the minimum functional 
design. Contingency cases defined in the Constellation Architecture Requirements Document 
(CARD) and many functions or constraints from the Human Systems Integration Requirements 
(HSIR) are not yet included. Each of these areas will require more work in the future, and could 
drive changes to the architecture. 





Also, some systems have been neglected from study so far due to immaturity. NASA has 
organized technology development research under the Exploration Technology Development 
Program (ETDP). One area of research critical for Altair is systems to compress the scavenged 
oxygen high enough to resupply PLSS tanks. Altair is also depending on the development of air 
quality monitors that can measure oxygen with sufficient accuracy to narrowly control cabin 
pressure and atmosphere composition, while providing monitoring of CCfi, humidity, and fire 
products in lightweight systems. Technologies to mitigate contamination with lunar regolith or 
dust are in development, and research to assess to hazards associated with lunar regolith or dust 
is in progress. Lunar dust could also pose a challenge to fire detection systems that would use 
particulates as a sign of a smoke. 

The Altair team will continue to develop the vehicle design as it progresses to a fonnal 
System Requirements Review. All of the functionality required by the Constellation documents 
must be assessed for inclusion in the vehicle, while still maintaining a safe, reliable, and mass or 
cost effective design. NASA will continue to work to develop a vehicle concept that safely, 
reliably, and efficiently to enable human exploration of the Moon, and prepare us for further 
journeys. 



